A HTTP Parameter Pollution vulnerability was discovered in Keycloak within the org.keycloak.protocol.saml package. The flaw exists because the SAML HTTP-Redirect binding response preserves the full query string provided in the initial authentication request. An attacker can craft an AuthnRequest with an AssertionConsumerServiceURL that already contains SAMLResponse and RelayState query parameters.
If the SAML client is configured with a wildcard redirect URI and allows the attacker to control these parameters, Keycloak will append its own SAML binding parameters to the existing ones in the redirect response. This results in duplicate parameters where the attacker-controlled values appear first. An attacker can exploit this against service providers that only parse the first occurrence of a query parameter to perform login CSRF or session swapping, effectively forcing a victim to authenticate into an attacker-controlled session.